Cyber Risk & Control Assessment
Identify material risks, evaluate controls and prioritise improvements that fit your operating environment.
Cybersecurity advisory · Governance · Risk · Assurance
30+ years in technology. Certified GRC expertise.
ZZ Cyber is Edward Naing — a CISA and CISM certified advisor who translates cybersecurity obligations into practical, measurable action, backed by more than three decades of technology, infrastructure and leadership experience.
- CISA® Certified Information Systems Auditor
- CISM® Certified Information Security Manager
- MBA — Technology Management
What we do
Focused support for better cyber outcomes.
Clear, proportionate advice that connects technical risk with business priorities—helping leaders make informed decisions and teams move forward with confidence.
Governance & Compliance
Strengthen policies, accountability, evidence and reporting against relevant security obligations and frameworks.
Security Assurance
Bring an independent, practical lens to remediation, third-party reviews, audit readiness and security reporting.
Our approach
Structured, practical and accountable.
We focus on the risks that matter, communicate them clearly and shape recommendations that can be owned and delivered.
Establish context
Clarify objectives, obligations, critical assets and the decisions your organisation needs to make.
Find the real gaps
Review evidence and controls to separate material exposure from noise.
Make action achievable
Prioritise pragmatic improvements with clear ownership and measurable outcomes.
Why ZZ Cyber
One senior consultant. No hand-offs.
No sales team, no junior consultants, no generic reports — just practical cybersecurity advice focused on reducing risk and improving decision-making.
More than 30 years of technology industry experience
CISA and CISM certified
Practical understanding of both technical and business environments
Experience across government, financial services and enterprise organisations
Evidence-based assessments and actionable recommendations
Direct engagement with a senior consultant from start to finish
Clear reporting without unnecessary technical jargon
Independent advice, free of vendor or product bias
About ZZ Cyber
Cybersecurity grounded in business reality.
Experience supporting organisations across
- Financial Services
- Australian Government
- NSW Government
- Critical Business Operations
- Security Operations Centres (SOC)
- Governance, Risk & Compliance (GRC)
- Cloud & Identity Security
ZZ Cyber is led by Edward Naing, who brings more than 30 years in the IT industry — spanning technology, infrastructure, operations and leadership — combined with CISA, CISM and MBA (Technology Management) credentials in governance, risk and assurance.
Our work is guided by evidence, clear communication and an understanding that effective security must support—not obstruct—the organisation it protects.
Risk-led
Evidence-based
Plain-spoken
Outcome-focused
Engagements & indicative fees
Scoped to fit the problem.
Every engagement is tailored to scope, complexity and organisational size. Fees below are general guidance only — get in touch for a fixed quote.
Essential Eight Readiness Assessment
From A$2,500
Independent review of Essential Eight maturity for small and medium businesses.
- Maturity assessment
- Evidence review
- Gap analysis
- Prioritised roadmap
- Executive summary
Cyber Risk Assessment
From A$3,500
Identify key cyber risks, control weaknesses and remediation priorities.
- Risk assessment report
- Control-gap analysis
- Risk register recommendations
- Management summary
Supplier Security Review
From A$1,500
Assess the security posture of vendors and service providers.
- Third-party risk review
- Findings summary
- Assurance recommendations
- Risk rating
Security Governance & Audit Readiness Review
From A$3,000
Assess governance processes, policies and audit evidence readiness.
- Policy review
- Governance assessment
- Evidence review
- Improvement recommendations
ISO 27001 Gap Assessment
From A$4,500
Determine readiness against ISO 27001 requirements.
- Gap assessment
- Control mapping
- Remediation roadmap
- Executive summary
Security Control Assessment
From A$4,000
Review control design and effectiveness across technology, cloud, identity and operational environments.
- Control assessment report
- Findings register
- Risk observations
- Improvement recommendations
Fractional vCISO Advisory
From A$1,500 / month
Ongoing security governance and advisory support without a full-time security leader.
- Monthly governance review
- Risk oversight
- Security roadmap guidance
- Stakeholder advisory support
- Management reporting
Project Security Review
From A$2,000
Independent security input for technology, cloud and business change initiatives.
- Design review
- Risk assessment
- Security recommendations
- Governance reporting
Let’s discuss your security priorities.
Tell us what you’re working through and where you need clarity.